GHSA-G5PH-F57V-MWJC OneUptime WhatsApp Webhook Missing Signature Verification

Summary The WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery stat...

Improper Verification of Cryptographic Signature

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

OneUptime WhatsApp Webhook Missing Signature Verification

Summary The WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery stat...

PT-2026-26199

Summary The WhatsApp POST webhook handler /notification/whatsapp/webhook processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery stat...

MAL-2026-1404 Malicious code in whatsapp-core-auth-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f0056922bde61f17500081c40e73bd86df9a2ec7688a11853a071aa3b4c6d8 The package whatsapp-core-auth-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious code in whatsapp-core-auth-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f0056922bde61f17500081c40e73bd86df9a2ec7688a11853a071aa3b4c6d8 The package whatsapp-core-auth-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview whatsapp-core-auth-drzak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview whatsapp-fastdesk-utils-drzak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in whatsapp-fastdesk-utils-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfe29253f5fa322c274903f6ae99d6746f274c0a17b2656150fb925da0ec74b8 The package whatsapp-fastdesk-utils-drzak was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1405 Malicious code in whatsapp-fastdesk-utils-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfe29253f5fa322c274903f6ae99d6746f274c0a17b2656150fb925da0ec74b8 The package whatsapp-fastdesk-utils-drzak was found to contain malicious code. Source: ghsa-malware...

CVE-2026-30959

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

CVE-2026-30959 OneUptime has WhatsApp Resend Verification Authorization Bypass

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

EUVD-2026-10703

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

CVE-2026-30959

The Connected documents reveal a vulnerability in OneUptime: the POST endpoint /api/user-whats-app/resend-verification-code allows any authenticated user to trigger a verification code resend for any UserWhatsApp item by ID, without validating ownership. The code-path for ownership verification e...

CVE-2026-30959 OneUptime has WhatsApp Resend Verification Authorization Bypass

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

CVE-2026-30959

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

CVE-2026-30959 OneUptime has WhatsApp Resend Verification Authorization Bypass

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. This affects the...

Signal and WhatsApp accounts targeted in phishing campaign

Dutch intelligence services AIVD and MIVD warn that Russian state‑backed hackers are running a large‑scale campaign to break into Signal and WhatsApp accounts of high‑value targets. The targets are said to be senior officials, military personnel, civil servants, and journalists. The attackers are...

Authorization Bypass Through User-Controlled Key

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

OneUptime has WhatsApp Resend Verification Authorization Bypass

Description The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated unlike the verify endpoint. Affected Source - Endpoint: UserWhatsAppAPI.ts - Service: UserWhatsAppService.ts - Verify...